Details of VAR-201707-0957

ID

VAR-201707-0957

CVE

CVE-2017-6755

TITLE

Cisco Prime Collaboration Provisioning Tool of Web Portal cross-site scripting vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2017-006087

DESCRIPTION

A vulnerability in the web portal of the Cisco Prime Collaboration Provisioning (PCP) Tool could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web interface of an affected system. More Information: CSCvc90312. Known Affected Releases: 12.1. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks. This issue is being tracked by Cisco Bug ID CSCvc90312. The tool provides IP communications services capabilities for IP telephony, voice mail, and unified communications environments. A remote attacker could exploit this vulnerability to perform operations as an administrator by injecting malicious JavaScript code into the PCP management UI

Trust: 1.98

sources: NVD: CVE-2017-6755 // JVNDB: JVNDB-2017-006087 // BID: 99878 // VULHUB: VHN-114958

AFFECTED PRODUCTS

vendor:	cisco	model:	prime collaboration provisioning	scope:	eq	version:	12.1	Trust: 1.9
vendor:	cisco	model:	prime collaboration provisioning	scope:	-	version:	-	Trust: 0.8

sources: BID: 99878 // JVNDB: JVNDB-2017-006087 // CNNVD: CNNVD-201707-1173 // NVD: CVE-2017-6755

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2017-6755
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2017-6755
value:	MEDIUM
Trust: 0.8
CNNVD:	CNNVD-201707-1173
value:	MEDIUM
Trust: 0.6
VULHUB:	VHN-114958
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2017-6755
severity:	MEDIUM
baseScore:	4.3
vectorString:	AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	8.6
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
VULHUB:	VHN-114958
severity:	MEDIUM
baseScore:	4.3
vectorString:	AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	8.6
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2017-6755
baseSeverity:	MEDIUM
baseScore:	6.1
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	REQUIRED
scope:	CHANGED
confidentialityImpact:	LOW
integrityImpact:	LOW
availabilityImpact:	NONE
exploitabilityScore:	2.8
impactScore:	2.7
version:	3.0
Trust: 1.8

sources: VULHUB: VHN-114958 // JVNDB: JVNDB-2017-006087 // CNNVD: CNNVD-201707-1173 // NVD: CVE-2017-6755

PROBLEMTYPE DATA

problemtype:

CWE-79

Trust: 1.9

sources: VULHUB: VHN-114958 // JVNDB: JVNDB-2017-006087 // NVD: CVE-2017-6755

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201707-1173

TYPE

XSS

Trust: 0.6

sources: CNNVD: CNNVD-201707-1173

CONFIGURATIONS

sources: JVNDB: JVNDB-2017-006087

PATCH

title:

cisco-sa-20170719-pcpt

url:

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170719-pcpt

Trust: 0.8

sources: JVNDB: JVNDB-2017-006087

EXTERNAL IDS

db:	NVD	id:	CVE-2017-6755	Trust: 2.8
db:	BID	id:	99878	Trust: 2.0
db:	SECTRACK	id:	1038960	Trust: 1.1
db:	JVNDB	id:	JVNDB-2017-006087	Trust: 0.8
db:	CNNVD	id:	CNNVD-201707-1173	Trust: 0.7
db:	NSFOCUS	id:	37215	Trust: 0.6
db:	VULHUB	id:	VHN-114958	Trust: 0.1

sources: VULHUB: VHN-114958 // BID: 99878 // JVNDB: JVNDB-2017-006087 // CNNVD: CNNVD-201707-1173 // NVD: CVE-2017-6755

REFERENCES

url:	https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20170719-pcpt	Trust: 2.0
url:	http://www.securityfocus.com/bid/99878	Trust: 1.7
url:	http://www.securitytracker.com/id/1038960	Trust: 1.1
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-6755	Trust: 0.8
url:	https://nvd.nist.gov/vuln/detail/cve-2017-6755	Trust: 0.8
url:	http://www.nsfocus.net/vulndb/37215	Trust: 0.6
url:	http://www.cisco.com/	Trust: 0.3
url:	http://www.cisco.com/en/us/products/ps12363/index.html	Trust: 0.3
url:	https://bst.cloudapps.cisco.com/bugsearch/bug/cscvc90312	Trust: 0.3

sources: VULHUB: VHN-114958 // BID: 99878 // JVNDB: JVNDB-2017-006087 // CNNVD: CNNVD-201707-1173 // NVD: CVE-2017-6755

CREDITS

Cisco

Trust: 0.9

sources: BID: 99878 // CNNVD: CNNVD-201707-1173

SOURCES

db:	VULHUB	id:	VHN-114958
db:	BID	id:	99878
db:	JVNDB	id:	JVNDB-2017-006087
db:	CNNVD	id:	CNNVD-201707-1173
db:	NVD	id:	CVE-2017-6755

LAST UPDATE DATE

2024-11-23T22:12:57.811000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-114958	date:	2017-07-28T00:00:00
db:	BID	id:	99878	date:	2017-07-19T00:00:00
db:	JVNDB	id:	JVNDB-2017-006087	date:	2017-08-17T00:00:00
db:	CNNVD	id:	CNNVD-201707-1173	date:	2017-07-27T00:00:00
db:	NVD	id:	CVE-2017-6755	date:	2024-11-21T03:30:27.377

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-114958	date:	2017-07-25T00:00:00
db:	BID	id:	99878	date:	2017-07-19T00:00:00
db:	JVNDB	id:	JVNDB-2017-006087	date:	2017-08-17T00:00:00
db:	CNNVD	id:	CNNVD-201707-1173	date:	2017-07-27T00:00:00
db:	NVD	id:	CVE-2017-6755	date:	2017-07-25T19:29:00.427